发布日期:2007-05-29

  更新日期:2007-08-28

  受影响系统:

  Apache Group Apache 2.2.4

  Apache Group Apache 2.0.59

  Apache Group Apache 1.3.37

  描述:

  BUGTRAQ ID: 24215

  CVE(CAN) ID: CVE-2007-3304

  Apache HTTP Server是一款流行的Web服务器。

  Apache HTTP Server Worker进程实现上存在多个漏洞,本地攻击者可能利用这些漏洞导致服务不可用。

  在发送信号之前Apache HTTP Server没有验证进程为Apache子进程。能够在Apache HTTP Server上运行脚本的本地攻击者可以控制记分板并终止任意进程,导致拒绝服务。

  如果Apache httpd安装了Prefork MPM模块的话,本地攻击者就可以修改worker_score和process_score数组使其引用任意进程ID,主进程向其发送了SIGUSR1信号的话就会导致拒绝服务。

  <*来源:Blazej Miga

  链接:https://marc.info/?l=apache-httpd-dev&m=118244472408600&w=2

  https://marc.info/?l=bugtraq&m=118046409606691&w=2

  https://bugzilla.redhat.com/long_list.cgi?buglist=245111

  https://httpd.apache.org/security/vulnerabilities_13.html

  https://httpd.apache.org/security/vulnerabilities_20.html

  https://httpd.apache.org/security/vulnerabilities_22.html

  https://www.redhat.com/support/errata/RHSA-2007-0532.html

  https://www.redhat.com/support/errata/RHSA-2007-0662.html

  https://www.redhat.com/support/errata/RHSA-2007-0557.html

  ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

  https://www.redhat.com/support/errata/RHSA-2007-0556.html

  *>

  建议:

  厂商补丁:

  Apache Group

  ------------

  目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

  https://svn.apache.org/viewvc?view=rev&revision=547987

  RedHat

  ------

  RedHat已经为此发布了一个安全公告(RHSA-2007:0662-01)以及相应补丁:

  RHSA-2007:0662-01:Moderate: httpd security update

  链接:https://www.redhat.com/support/errata/RHSA-2007-0662.html

  SGI

  ---

  SGI已经为此发布了一个安全公告(20070701-01-P)以及相应补丁:

  20070701-01-P:SGI Advanced Linux Environment 3 Security Update #78

  链接:ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc